...
| Code Block | ||
|---|---|---|
| ||
public class SomeObject {
// Locks on the object's monitor
public synchronized void changeValue() {
// ...
}
public static SomeObject lookup(String name) {
// ...
}
}
// Untrusted code
String name = // ...
SomeObject someObject = SomeObject.lookup(name);
if (someObject == null) {
// ... handle error
}
synchronized (someObject) {
while (true) {
// Indefinitely delaylock someObject
Thread.sleep(Integer.MAX_VALUE);
}
}
|
...
| Code Block | ||
|---|---|---|
| ||
public class SomeObject {
public final Object lock = new Object();
public void changeValue() {
synchronized (lock) {
// ...
}
}
}
// Untrusted code
SomeObject someObject = new SomeObject();
someObject.lock.wait();
|
...
This noncompliant code example also violates rule OBJ01-J. Limit accessibility of fields.
...
Exposing the lock object to untrusted code can result in DoS.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
LCK00-J | low | probable | medium | P4 | L3 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The Checker Framework |
| Lock Checker | Concurrency and lock errors (see Chapter 6) | ||||||
| CodeSonar |
| JAVA.CONCURRENCY.LOCK.ISTR | Synchronization on Interned String (Java) | ||||||
| Parasoft Jtest |
| CERT.LCK00.SOPF | Do not synchronize on "public" fields since doing so may cause deadlocks | |||||||
| SonarQube |
|
|
| S2445 |
Related Guidelines
Bibliography
Item 52. Document Thread Safety |
...